Quick answer
Authenticate every sending domain, use accurate sender identity, increase volume gradually, remove bounces and opt-outs, keep complaint rates low, and separate high-volume outreach from critical transactional mail. Deliverability is a reputation system; no subject-line trick can compensate for poor targeting or unwanted volume.
This guide covers legitimate brand-to-creator outreach. Legal requirements vary by location and recipient type, so the sending program also needs jurisdiction-specific review.
What matters most
Google requires all senders to personal Gmail accounts to use SPF or DKIM and imposes stronger SPF, DKIM, DMARC, alignment, TLS, and one-click unsubscribe requirements on bulk senders near 5,000 messages per day. Google also tells senders to keep reported spam below 0.3 percent and to increase volume slowly.
Use a real person and monitored reply address. Align the visible From domain with authenticated infrastructure, keep DNS records current, and monitor bounces, blocks, complaints, and authentication failures. Google Postmaster Tools can help once the domain has enough traffic.
Operational quality matters as much as DNS. Send only to creators who fit the campaign, avoid misleading subjects, explain why the recipient was selected, make it easy to decline, and stop quickly when the address is invalid or the recipient objects.
A practical workflow
- 01
Configure SPF, DKIM, DMARC, TLS, and valid DNS for every sender.
- 02
Separate creator outreach from transactional and employee-critical traffic where appropriate.
- 03
Warm new domains and mailboxes with low, consistent, legitimate volume.
- 04
Monitor delivery, bounce, complaint, reply, and opt-out signals.
- 05
Pause and investigate when reputation or authentication deteriorates.
Authentication, in the order to set it up
SPF first: a DNS record listing the servers allowed to send for the domain. The constraint that catches people is the ten-DNS-lookup limit, which a domain quietly exceeds after adding its fourth or fifth service, at which point the record stops evaluating and every message fails SPF at once.
DKIM second: a cryptographic signature on each message, verified against a public key in DNS. Use a 2048-bit key where the provider supports it, give each sending service its own selector, and confirm the signature survives whatever sits between your application and the recipient.
DMARC third, and it is the one that ties the other two together. Publish it initially with a policy of none and a reporting address, read the reports until you can account for every legitimate sender, then move to quarantine and then to reject. The part most often missed is alignment: DMARC requires the visible From domain to match the domain that passed SPF or DKIM, so a message can pass both checks and still fail DMARC because it is signed by your provider's domain rather than your own.
What the bulk-sender requirements actually ask for
Since early 2024 the largest consumer mailbox providers have applied a two-tier standard. Every sender needs SPF or DKIM and valid forward and reverse DNS, must transmit over TLS, and must not send from addresses that impersonate the provider. That baseline applies whatever your volume.
Senders at bulk volume, defined by Google as approximately 5,000 messages a day to Gmail addresses, take on more: SPF and DKIM both, a DMARC policy on the sending domain, alignment between the From domain and the authenticated domain, and one-click unsubscribe in the message headers for marketing and subscribed mail, with unsubscribe requests processed within two days.
The requirement with real operational teeth is the complaint rate. Google's guidance is to keep the spam rate reported in Postmaster Tools below 0.3 percent and to treat 0.1 percent as the working ceiling. That is a very small number: three complaints in a thousand messages puts a sending domain into trouble, which means complaint rate is set by targeting quality long before it is set by any technical control.
Domain and mailbox strategy
Send outreach from a subdomain rather than the root domain that carries invoices, password resets and customer support. Reputation is largely evaluated per sending domain, so this contains the damage: an outreach campaign that goes badly should not be able to stop a customer receiving a receipt.
Warm new domains and mailboxes gradually. A domain with no sending history that suddenly emits several thousand messages looks exactly like a domain that was registered to do so, because that is the pattern the filters were built to catch. Build volume over weeks with genuine mail that gets genuine replies.
Use a real person's name and a monitored reply address. A no-reply address on an outreach campaign is a contradiction: you are asking someone to respond while telling their mail client that responses are not read. And do not use inbox rotation or account-cycling tools to spread volume across many mailboxes. Their purpose is to prevent a reputation system from measuring a sender accurately, which makes them a policy problem rather than a technique, and they solve nothing about the underlying reason the volume was generating complaints.
List hygiene is a deliverability control
Remove hard bounces immediately and permanently. Continuing to send to an address that has already rejected you is one of the clearest negative signals available to a filter, and repeated attempts turn a single bad address into a pattern.
Suppress opt-outs globally rather than per campaign. An unsubscribe honoured in one campaign and ignored in the next is both a compliance failure and the fastest route to a complaint, and complaints cost far more than the message was ever worth. Keep the suppression list at the account level and check it before every send.
Do not re-import an old list. Addresses decay, and abandoned addresses are sometimes recycled by providers into spam traps specifically to catch senders who never cleaned their data. And recognise the real lever: complaint rate is a function of relevance. A message that lands with a creator who genuinely fits the campaign, at an address they published for the purpose, does not generate complaints. No amount of DNS configuration compensates for volume sent to people who did not want it.
Common mistakes
- Using a fresh domain for a sudden large send.
- Relying on inbox-rotation tools to hide unwanted volume.
- Keeping hard bounces and opt-outs in future lists.
- Mixing critical customer email with risky prospecting traffic.
Working checklist
- SPF, DKIM, DMARC, TLS, and DNS are valid.
- Sender and reply identities are real and monitored.
- Volume grows gradually and predictably.
- Bounces, complaints, and opt-outs are suppressed.
- Postmaster and provider feedback are reviewed.
Questions and answers
- What complaint rate is too high?
- Google's published guidance is to stay below 0.3 percent of messages reported as spam, and to treat 0.1 percent as the level you should not routinely reach. Both numbers are small enough that they are determined by who you are sending to rather than by how the mail is configured. Monitor the rate in Postmaster Tools, and treat a rise as a targeting problem until proven otherwise.
- Do you need a separate domain for outreach?
- A subdomain of your main domain is the usual answer, and it is worth doing. It isolates reputation so a problem in outreach cannot affect transactional and customer mail, while still being visibly connected to the brand. A completely unrelated lookalike domain achieves the isolation but costs trust, since it is also the pattern used by senders who want to be hard to identify.
- Why do outreach emails land in Promotions rather than the inbox?
- Tabbed placement is a categorisation decision rather than a spam judgement, driven by signals such as image-heavy layout, tracking pixels, marketing-style links, bulk-mail headers and how recipients have engaged with similar mail. Plain-text-style messages with few links, sent from a real person to a small, well-chosen list, are categorised as correspondence far more often, which is another reason short first emails outperform designed ones.
- Does open tracking hurt deliverability?
- It can, and it also increasingly fails to tell you anything. A tracking pixel adds a remote image and a redirect domain, both of which push a message toward a promotional classification, and mail privacy features now pre-fetch images so a recorded open may involve no human at all. For creator outreach, where volumes are small and reply rate is the metric that matters, turning it off costs almost nothing.
Sources and verification
Written by Nick Lombardi, Co-Founder & CTO, Streamforge. Published September 2, 2026; last verified September 2, 2026. Platform rules change, so confirm details against the primary sources below.

